WatchGuard Fireware OS CVE-2025-13937

Exploitation requires an authenticated session with high administrative privileges on the WatchGuard Fireware OS web management interface - this is the primary limiting factor. The ConnectWise Technology Integration module must be present and accessible (it is a specific integration feature, not enabled in all deployments). Trigger requires passive user interaction from a separate victim user or administrator who visits the page where the payload was stored. Exploitation is therefore a two-party scenario: one high-privileged injector and at least one additional user who loads the poisoned page. Environments with a single administrator, or where ConnectWise integration is not configured, are not meaningfully exposed. Remote network access to the management interface is required, but no unauthenticated access path exists.

The CVSS 4.0 score of 4.8 (Medium) reflects the elevated privilege bar (PR:H) required to inject the payload and the passive user interaction (UI:P) needed to trigger it, both of which substantially constrain exploitability. The impact metrics confirm no direct compromise of the vulnerable system itself - harm is limited to the subsequent system (victim browser) with Low confidentiality and integrity impact (SC:L/SI:L). EPSS at 0.03% (9th percentile) corroborates the low real-world exploitation probability, and the vulnerability is absent from CISA KEV. No POC has been publicly identified. The practical risk profile is that of an insider or already-compromised admin using XSS to pivot laterally to other admin sessions - a meaningful but narrow threat model. Organizations running ConnectWise-integrated WatchGuard appliances with multiple administrative users face the most relevant exposure. The combination of high required privilege, user interaction dependency, and low EPSS argues against emergency prioritization, though patching remains warranted.

An attacker who has obtained high-privileged administrative credentials to a WatchGuard Firebox web management interface navigates to the ConnectWise Technology Integration module and injects a malicious JavaScript payload into an input field that is stored without sanitization. When a second administrator or authorized user subsequently loads the affected management page, the script executes in their browser, potentially harvesting session cookies, capturing credentials entered on-screen, or performing administrative actions under the victim's authenticated session. No public exploit code exists at time of analysis.